AI Agent Containment & Breach Debrief Workbench

1. Breach Scenarios

Severity: High

Unvetted Model Repo Scraping SSRF + Bash

Agent scans README from malicious HuggingFace mirror; embedded prompt injection forces raw subshell token scraping.

Vector: Indirect Prompt

MCP Server Docker Socket Hijack PrivEsc

Tool parameters abuse unconstrained file descriptors to map host /var/run/docker.sock and mount root volumes.

Vector: Tool Param Abuse

Metadata Service & Egress Exfil Cloud Sec

Agent curl utility reaches cloud metadata instance (169.254.169.254) and pipes IAM credentials to external webhook.

Vector: Network SSRF

Recursive Multi-Agent Confusion Protocol

Delegated sub-agent hallucinates elevated orchestration authority, triggering unauthorized batch database wipe.

Vector: Context Pollution

Containment Guardrails

Ephemeral MicroVM Isolation

Read-only rootfs + single-use sandbox per execution cycle.

Strict AST Tool-Call Whitelist

Syntactic argument grammar enforcement; rejects shell meta-chars.

Zero-Trust Dynamic Egress Proxy

Blocks RFC-1918, link-local, and unknown external domain CIDRs.

Human-in-the-Loop Quarantine

Mandatory dual-key token approval for destructive / egress actions.

Agent Tool Execution Pipeline Stages

Click stage to inspect defenses

1. Ingestion

Untrusted prompt, RAG chunks & repo payloads

2. Planner

Context synthesis & tool dispatch generation

3. Dispatch

MCP schema validation & argument parsing

4. Execution

Container runtime, syscalls & socket I/O

SIM SPEED:

Stage 1: Prompt & Context Ingestion Defenses

Raw data streams from repositories and user queries enter here. Without input sanitization and semantic drift filters, malicious prompt payloads can hijack the planner's system prompt instructions.

CONTAINMENT_TRIPWIRE_STREAM // TELEMETRY_v2.4

[00:00:00.00] [INIT] Workbench initialized. Select a breach scenario and click 'Run Exploit Simulation'.

2. Blast Radius & Metrics

Contained: 0

Defense-in-Depth Score

75%

Hardened Posture

Filesystem Exposure Low (Isolated)

Ephemeral Mount RO OverlayFS

Network Egress Risk Critical (SSRF)

Egress Filter Permissive (No Proxy)

Host Credential Leakage Zero Leak

Secret Vault AST Sanitized

Debrief Assessment

Current configuration intercepts AST parameter injections but remains vulnerable to outbound SSRF calls to internal metadata APIs. Activate 'Zero-Trust Dynamic Egress Proxy' to achieve full defense-in-depth isolation.